Notepad++ v8.8.9: Vulnerability-fix
-
@donho said in Notepad++ v8.8.9: Vulnerability-fix:
Add ability to update users’ langs.xml & stylers.xml from model XML files.
Sorry for the mess it has created. I highly recommend not triggering auto-update on this one.
I should have the a PR today or tomorrow which will fix #17289
-
Thank you for your reply. I understand what you wrote, but that still doesn’t explain the problem. PowerShell was just an example. This also applies to other languages, like Python. But anyway. Up to version 8.8.8, this problem didn’t exist. In this version, only ‘Black board’ causes problems, but all the other styles look good and don’t have the issues that were present in version 8.8.9.
-
@KleinerDickerTiger said in Notepad++ v8.8.9: Vulnerability-fix:
I understand what you wrote, but that still doesn’t explain the problem.
If it doesn’t explain the problem to you, then either you didn’t understand or I didn’t say enough.
PowerShell was just an example.
As it was for me.
Many of the themes are missing many of the languages, including Powershell. And even on the languages they do have, over time, new styles have been added to some of those languages. So your themes were missing many languages and many styles that Notepad++ supports. The reason that you didn’t notice in v8.8.8 and earlier is because the older versions of Notepad++ would just use the theme’s default FG/BG colors on any style or language that wasn’t defined… but it wouldn’t allow you to change them in the Style Configurator, because they would’t even be listed there. (For example, if you had originally installed v8.3.1 a couple years ago, and had upgraded through v8.8.8, you would not be able to use Style Configurator to set the IDENTIFIER or FUNCTION colors in Powershell, even though Notepad++ has supported those colors for a long time now.)
The new feature in v8.8.9 adds in those missing languages and missing styles, and that is working as designed. And with that, you can now set those colors to anything you want in the Style Configurator, as designed. The problem is that when it adds in the missing languages and styles, it had to pick a color of some sort… and I foolishly chose to set the colors to be the same colors that would be used in
stylers.xml(ie, it matches the default light theme of Notepad++): this makes the jarring black-text-on-white-background for any of the languages or styles that were added into the theme by the new v8.8.9 feature.Starting in the next version, if it finds a language or style entry that is missing from your theme, instead of using the light-theme’s equivalent color, it will populate any missing colors using your theme’s default FG/BG colors, so it will behave more like v8.8.8-and-earlier, but with the improvement that you will now be able to edit those previously-missing colors in the Style Configurator, and they will be saved in the theme file going forward (neither of which v8.8.8-and-earlier did for you).
-
@PeterJones said in Notepad++ v8.8.9: Vulnerability-fix:
Sorry for the mess it has created. I highly recommend not triggering auto-update on this one.
No problem - as the author of theme system, I didn’t think of it while I was reviewing the PR either.
I should have the a PR today or tomorrow which will fix #17289
Take your time. It’s an annoying bug for sure, but I prefer that we think of every aspect to not run after another corner case after next release.
-
@PeterJones said:
I foolishly chose to set the colors
I think you’re being too hard on yourself.
The overall idea of the change is a good one and moves the Notepad++ code forward.
Sometimes it just happens that development takes 3 steps forward and 1 step back, for a net gain of +2. Thus, still a win.
Thank you for your contribution. -
P PeterJones referenced this topic on
-
@PeterJones
In your FAQ you describe the way to manually update the style using an “old” version of the file. Do you think it would make sense that in your code you do a backup of the file before you do the update? Like this any unexpected change can be compared to the previous version of the style.
Another idea: Would it make sense to inform the user about the change of style (e.g. in a message box)? Perhaps the user could even be asked, if he agrees to update the files. A message something like “your file is outdated. Do you want to update to a current version. yes/no”
Just some thoughts for this great feature you implemented. -
@sevem47 ,
A backup wouldn’t be a bad idea. (And given the problems with the v8.8.9 version, I wish the backup had been there to begin with.) If @donho agrees, I can add the backup with just a couple lines of code.
As for a messagebox or other user prompt: I believe the majority of users would find it more annoying than helpful (given that there are users complaining about the 30-60ms that the current check adds, they would definitely complain about having to answer prompts for the langs and/or stylers/theme files). I am doubtful that @donho would want me to implement that – if he does, I could add it; but my guess is he’d say no to it.
-
@sevem47
No messagebox for sure, and no backup file for the moment.
The update xml files should be without issue, and we will do our best to make the update without issue. -
@PeterJones Hi after following those 2 Color RGB Values settings the white margin is now of same Khaki Style back again. But it looks like next any upgrade can override this config and need to do it manually again.
-
@Saquib-Akhtar said in Notepad++ v8.8.9: Vulnerability-fix:
But it looks like next any upgrade can override this config and need to do it manually again.
Nope. It does not overwrite any information in the style or theme file (except where it tracks the model-file’s date). The styles that got the light-mode colors were styles that your theme was missing. It only adds missing information, and will not overwrite any style that already exists in your theme.
-
@PeterJones said in Notepad++ v8.8.9: Vulnerability-fix:
@Saquib-Akhtar said in Notepad++ v8.8.9: Vulnerability-fix:
But it looks like next any upgrade can override this config and need to do it manually again.
Nope. It does not overwrite any information in the style or theme file (except where it tracks the model-file’s date). The styles that got the light-mode colors were styles that your theme was missing. It only adds missing information, and will not overwrite any style that already exists in your theme.
That’s why we don’t need to do the backup.
